Types of Attacks

Type of Attacks

Network Security - Domain 1: Defense in Depth

Watering Hole Attacks

What is it?

Watering hole attacks involve uploading a malicious program to a site where people commonly visit (the watering hole). By placing the malware on a popular site that users visit repeatedly, watering hole attacks use our own habits to spread malware or infect computers.

Watering Hole Defense

• Keep antivirus and anti-malware programs updated, as detecting when malware is being downloaded is difficult for those trained in malware defense and even more difficult for those who are not suspecting an attack.

• Be diligent in staying up-to-date with patching your computer.

• Watch for Downloads that you did not initiate

• Run scans if computer appears sluggish or "not right"

Typosquatting

​What is it?

Typosquatting, or URL hijacking involves slightly changing the URL of a website so that it resembles a well-known site (i.e. Gooogle.com) To a user who is not paying close attention, the site that loads may seem to be exactly what they intended and may unknowingly attempt to login or provide some personal information.

Session hijacking occurs when an attacker steals a cookie that is used to authenticate a user on a site. Cookies are small collections of data that can be used to authenticate a user to a website instead of having to login every single time.

​Session Hijacking

Client hijacking or clickjacking, happens when attacker will hide a button or link on top of another image. The link will be invisible, but when a user goes to click on the image they see on the screen, they will press on the link.

​Client Hijacking

Other Types of Hijacking.

In a Distributed Denial of Service (DDoS) attack the agents creating the traffic or processes are spread out amongst a variety of systems. These could be actual computers, servers, or even small-footprint systems like Internet of Things (IoT) devices. While the payloads from these devices are comparatively small, a multitude of them working in concert can take up large swaths of bandwidth relatively easily

​DDoS Attack

Denial of Service or DoS attacks, seek to disrupt the availability of a service or information. DoS renders services inaccessible, prevents communication, or creates distractions to allow for another exploit to happen in parallel or in sequence

​DoS Attack

DoS and DDoS Attacks

Defense Against DoS Attacks

Properly configure your public-facing servers so that connections are monitored. Ensure that systems are properly load-balanced and that adequate bandwidth is available for your environment. Proper security monitoring using IDS/IPS that are both experimental and signature-based can mitigate some of these concerns by alerting personnel to anomalous activities. Additionally, ensure the use of unsecure protocols like ICMP and UDP is only in effect when absolutely required.

Adversary (Man) in the Middle

An On-Path or Adversary-in-the-Middle (AiTM) attack, formerly known as a man-in-the-middle attack, is what it sounds like: an attacker positions themselves in between a user and their intended destination. Usually, the user is unaware of the presence of an adversary in the middle, and an attacker can use their position to capture information, reroute traffic, modify content, and much more. MAC Spoofing or ARP Spoofing.

Adversary (Man) in the Browser

Adversary-in-the-Browser, formerly known as a Man-in-the-Browser, seeks to allow the attacker to gain a foothold within the user’s browser. Trojan malware is injected into the browser, which provides an intermediary between the browser’s calls and the user. This means that the malware rides on the browser’s system calls and privileges, making it harder for system- and network-level defenses to track. The attackers typically leverage existing vulnerabilities in browsers to gain this foothold. Infected clients may try to “phone home” or reach back to their Command-and-Control (C&C) servers, which the attacker sets up.

Credential Replay Attack

A credential replay network attack, also known as a replay attack, occurs when an attacker intercepts and reuses valid authentication credentials to gain unauthorized access to a system or network. In this type of attack, the attacker doesn’t need to know the actual credentials; they simply replay the captured authentication data to impersonate a legitimate user.

DNS poisoning, or as DNS spoofing, is when the DNS server has been altered and does not translate the proper IP address to a domain name. This can be dangerous. For example, think about if a user wants to go to chase.com to log into their bank account, but the DNS server has been altered and they are sent to a malicious server disguised to look like the real site.

​DNS Poisoning

Someone changes the registration of a domain name illegally? Currently, osu.edu is registered to Ohio State University, but what if Oregon State University changed the domain registration without Ohio State’s permission and then took the domain name

​Domain Hijacking

DNS (Domain Name Server Attacks

​URL Redirection

​A URL redirection attack is when a victim is redirected to a URL that they did not mean to go to, usually a malicious website.

Buffer Overflow

Buffer overflows occur when there are no safety guards in place to stop data from being inserted into variables that cannot hold the amount of data that is attempting to be stored. if the data being used to overflow the variable in software is specially crafted, the data that overwrites the return address can be another address in memory that performs legitimate code instructions. This would result in the code executing instructions in an order that was not originally intended. Buffer overflows can be very dangerous and can result in software that was written for one purpose actually performing a series of actions that are the complete opposite.

Race Conditions

Race conditions are decision points in code where the path taken by the code is dictated by how fast data is written to variables, registers, or memory positions instead of the values themselves. This is because of the race to write to memory first, and the variable written first “wins.” This occurs due to poor coding techniques where shared memory is not locked before multiple processes attempt to write to the shared memory.

​A Brute Force attack is done by trying all combinations and permutations (such as a password) until the right guess works. This attack, therefore, is slow. Brute force attacks attempted online will be subject to failed logon restrictions (lock out after X failed attempts). Brute-force attacks attempted offline will not lock you out.

​​Brute Force

​Dictionary attacks are a form of brute force attack that uses commonly used words or passwords from a list. Dictionary attacks are only good against simplistic and weak passwords. To combat dictionary attacks, enforce strong password criteria (complexity, length, re-use, etc.).

​​Dictionary Attack

​This technique involves trying a small set of commonly used passwords across numerous accounts, hoping to strike it lucky. While not the most efficient method, password spraying avoids account lockouts and relies on the chance of guessing a password correctly.

​​Spraying Attack

​Pass the Hash is when a malicious attacker gains the password hash of a user and is able to use it to gain access to a system. Typically, when a user types in a password, the system hashes the password and then checks this hash versus the hash stored. If they match, the user is then granted access to the system.

​​Pass the Hash

​Password Attacks

SQL Injection

SQL injection attack. SQL stands for Structured Query Language used in databases. Databases include search fields where users can search the database using queries. If programmers are not careful, that search box may allow hackers to finish out one database query but piggyback on another query of their own.A knowledgeable attacker that knows SQL can cut short the SQL query being performed and join on a query of their own choosing in order to explore the database’s contents, structure, and what other data is stored in the overall database–all from the comfort of a webpage search box or order form

Cross-Site Scripting (XSS)

is a type of injection attack where malicious scripts can be uploaded into the website code that the attacker can use to send to the end user, typically utilizing a browser-side script. The script is then executed by the victim under their credentials, allowing attackers to bypass access controls and impersonate users. XSS typically occurs when a web application allows data entry without identification and authentication of the source, and/or dynamic content is sent to users without validation. JavaScript, HTML, and Flash are some vectors that an attacker leverages in order to execute their attacks.

Zero-Day Attacks

Zero-day vulnerabilities are security vulnerabilities in software, hardware, or firmware that are unknown to the vendor or developer and have not been patched or mitigated. The term “zero-day” refers to the fact that from the day the vulnerability is discovered or exploited, there are zero days during which the developer has had the opportunity to release a fix or patch. There are several key characteristics of zeroday vulnerabilities.